What happened
On July 16, 2022, compromised Impermax team wallets lost approximately 9 million IMX tokens and most of the protocol-owned liquidity. The figure is a token quantity, not a $9 million loss. Impermax said its lending contracts and user positions were unaffected.
The team described partial asset recovery and proposed replacing IMX using a snapshot from before the incident.
Technical root cause
Private keys for team-controlled wallets were compromised. Impermax did not disclose how the keys were obtained; its postmortem identified no exploit of the lending contracts.
How it happened
- An attacker obtained private keys for several team wallets around 17:00 UTC, according to Impermax.
- The attacker took IMX and protocol-owned liquidity while the team tried to move assets out.
- Impermax sold tokens ahead of a potential attacker sale and said this secured some liquidity-provider funds and recovered some assets from attacker-held liquidity.
- The announced recovery plan proposed a replacement token for holders represented in a pre-incident snapshot.
Protocol details
Classification
Borrowing and Lending / Key Compromise
Protocol Type
Exploit/Other
Affected asset / contract
IMX
Implementation language
Solidity
Protocol links
Website
@ImpermaxFinance
Security review history
- CertiK View report
Evidence
- analysis IMX incident: post mortem and recovery plan impermax.medium.com
- analysis Web Archive web.archive.org
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
